Dir 619l Firmware CVE-2025-6368

Despite the CVSS 3.1 score of 8.8 (High), this vulnerability presents CRITICAL real-world risk due to multiple compounding factors: (1) Authentication requirement (PR:L) is the only limiting factor in the CVSS vector, but the vulnerable device is a residential router where attackers frequently obtain credentials via weak defaults, prior breaches, or CSRF; (2) Public exploit code availability dramatically increases practical exploitability; (3) The device is end-of-life with zero vendor support, meaning no patches will ever be released; (4) Stack-based buffer overflows are highly reliable for code execution on embedded Linux systems with predictable memory layouts; (5) An affected router provides complete network access and can be weaponized for lateral movement, botnet recruitment, or man-in-the-middle attacks. EPSS score would likely exceed 85-90% given public POC availability and end-of-life status. From an SSVC perspective: Exploitation is Public, the attack is Automatable, and Technical Impact is Complete (code execution). This is a MANDATORY remediation priority for any organization or user with this device.

An attacker with network access to the target network identifies a D-Link DIR-619L router via port scanning or SHODAN/Censys reconnaissance. The attacker either: (1) uses default credentials (commonly admin/admin or admin/password) to authenticate to the web interface, or (2) exploits a prior CSRF vulnerability to trick an authenticated admin into triggering the exploit. The attacker then sends a crafted POST request to /goform/formSetEmail with a malicious payload in the curTime or config.smtp_email_subject parameter. The oversized input overwrites the stack buffer, corrupting the return address with shellcode address. Upon function return, the device executes the attacker's arbitrary code with root privileges. The attacker gains complete control of the router, enabling: establishment of reverse shell for persistent access, DNS hijacking for traffic interception, man-in-the-middle attacks on all network traffic, botnet recruitment, or lateral movement to internal network resources. Public proof-of-concept code exists, reducing the skill floor for exploitation to script-kiddie level.